Exploited in September and October 2026: 79 KEV Additions and Their EPSS on Listing Day

Every month CISA adds a few dozen CVEs to its Known Exploited Vulnerabilities catalog, and every addition is a fact: someone was seen exploiting the vulnerability against real targets. This readout covers September and October 2026, computed from the isMalicious CVE catalog on 9 November 2026. For each addition it also reads the EPSS score FIRST published on the day CISA listed it, which turns out to be the most useful number here. It comes with a correction to the August issue, whose count and EPSS figures were wrong. The queries are published so the figures can be checked, and the live list is at /cve/kev.

The two months in numbers

Additions per month over the thirteen months we read, October 2025 to October 2026: 31, 11, 20, 17, 28, 26, 31, 21, 23, 26, 31, then 43 and 36. September is the highest of the series.

Finding 1: EPSS is lowest on the day of listing

For every addition from August to October, we asked FIRST's EPSS API for the score it published on the day CISA listed the CVE, and compared it with the score of 9 November.

Over the three months, 20 of the 110 additions had no score at all on the day CISA listed them, and every one of them was listed on the day its CVE was published, or before. Of the 90 that had a score, 52 were under 1%. By 9 November the same 90 had a median of 13.1%: 69 had more than doubled, and none had fallen by half.

The exceptions are old vulnerabilities, which EPSS has had time to learn. In October, the five scored additions published more than a year before their listing had a median of 91% on the day of listing.

Practical reading: EPSS is at its weakest exactly when a KEV entry is new, which is when the patch decision is made. It is a good sort key for an old backlog and a poor gate for this week's exploited vulnerabilities. A KEV entry should override an EPSS score, and an EPSS score taken on the day of listing should be re-read a few weeks later.

Finding 2: the network edge, again

28 of the 79 additions are network and security appliances or their management consoles: VPN and remote-access gateways, firewalls, email security gateways, application delivery controllers, routers, switches and SD-WAN. That is 18 of 43 in September and 10 of 36 in October.

The same names come back:

• Cisco, six additions: Firewall Management Center (CVE-2026-20079, CVSS 10.0), two Secure Email Gateway flaws, Identity Services Engine, Catalyst SD-WAN Manager, and the Adaptive Security Appliance and Firewall Threat Defense.
• Citrix NetScaler, four, three of them in September.
• Ivanti Connect Secure, three in October, the last one (CVE-2026-118527) listed four days before its NVD publication.
• Fortinet (FortiMail and two multi-product advisories) and MikroTik RouterOS, three each.

Remote support and management tools sit next to them: ConnectWise ScreenConnect and N-able N-central in September, BeyondTrust Remote Support in October. These products face the internet by design and run with high privileges, which makes one flaw in them worth a great deal to an attacker.

Finding 3: exploited at medium or low severity

Every addition carries a CVSS v3 score this time, and 68 of 79 are High or Critical. The other 11 are the ones a severity-sorted queue would bury. October has eight:

• four Plex Media Server flaws added on the same day, two of them at 4.3;
• a Broadcom VMware ESX insufficient-logging flaw at 2.7, CVE-2026-41709;
• a Strapi cleartext-storage flaw at 4.9, a Fortinet path traversal at 6.5, and a Siemens Software Center search-path flaw at 6.7.

September's three are a Starlette request-smuggling flaw at 6.5, a Linux kernel race condition at 5.5, and a MikroTik RouterOS flaw at 6.5. A low score describes the flaw on its own; it says nothing about whether someone found a use for it.

As a base rate, 173,627 of the 421,471 CVEs in our catalog score 7.0 or higher, and 44,188 score 9.0 or higher. Ranking by CVSS puts the 79 exploited vulnerabilities somewhere inside a set of forty to one hundred and seventy thousand.

Finding 4: same-day listings and a legacy batch

September was fast: 19 of 43 additions came within one day of the CVE's publication, two of them before the NVD published it (GitLab CVE-2026-85706 and Acronis Backup CVE-2026-87886). These are vulnerabilities disclosed because they were already being exploited. The median delay was 3 days.

October's median of 10 days comes from a batch of five old vulnerabilities added on 8 October: ProFTPD CVE-2015-3306, ISC BIND CVE-2015-5477, Apache Struts CVE-2016-3081, ONLYOFFICE Docs CVE-2021-3199 and Strapi CVE-2023-22894. The first three score 99.5%, 99.6% and 96.5% on EPSS on 9 November, and already scored 97%, 91% and 93% on the day of listing: the model had years of signals on them. Like the 2015 to 2023 batch added at the end of August, they are a reminder that an old vulnerability in deployed software stays exploitable as long as it stays unpatched.

Finding 5: more three-day deadlines

63 of the 79 additions carry a three-day due date, against 22 of 31 in August; the other 16 have fourteen days. The share given three days went from 71% in August to 79% in September and 81% in October. The due date is on every row of /cve/kev.

What this means for a patch queue

1. Treat KEV membership as a hard first sort key, ahead of any score.
2. Do not trust an EPSS score read on the day of listing. Re-read it after a few weeks: of the 90 additions from August to October that had a score on their listing day, 69 had more than doubled by 9 November.
3. Inventory your internet-facing appliances first. More than a third of these two months are gateways, firewalls and their consoles.
4. Do not let a medium or low CVSS score push an exploited vulnerability down the list. Eleven of the 79 scored below 7.0.
5. Watch the KEV due date. It is CISA's own urgency signal, and over these three months it was three days more and more often.

Method

Source: KEV additions, CVSS v3 scores, due dates and publication dates come from the isMalicious CVE catalog, which syncs the NVD and the CISA KEV feed, read on 2026-11-09. Scores on the day of listing come from FIRST's public EPSS API (api.first.org/data/v1/epss), queried with date set to each CVE's KEV addition date. Scores of 9 November come from our catalog, which has refreshed EPSS daily from FIRST since 25 September; that day it matched FIRST's API to three decimals for 78 of the 79 additions, and by 0.012 for the last one. Windows: kevDateAdded from 2026-09-01 to 2026-09-30 and from 2026-10-01 to 2026-10-31 inclusive, UTC; Finding 1 adds August, from 2026-08-01. The whole KEV catalog held 1,769 entries at the time of reading, of which 55 have an EPSS below 1% and 910 at or above 50%. Outside KEV, 337 CVEs score 0.9 or higher.

Two corrections to our own data, both of which change the August issue:

• Until 25 September our catalog wrote a CVE's EPSS score once, when the CVE first appeared, and never refreshed it. The August issue read those stale values on 3 September and reported 18 of 26 additions under 1%, with a median of 0.7%. FIRST's published scores for that day put 4 of the 31 under 1% and the median at 32.4%.
• Eleven KEV additions from August to October reached our catalog only on 23 October. Until then the catalog held no row for them, so /cve/kev did not list them. Six of them are in August, two in September and three in October, so August holds 31 additions, not 26. No addition has reached the catalog late since.

The August issue has been corrected on both counts, with the listing-day scores from FIRST. The queries are in docs/queries/kev-monthly-readout.sql in the isMalicious repository; the live list with due dates is at ismalicious.com/cve/kev, and each CVE above links to its advisory page.